xref: /freebsd/contrib/bearssl/src/symcipher/aes_x86ni_ctrcbc.c (revision 8ddb146abcdf061be9f2c0db7e391697dafad85c)
1 /*
2  * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining
5  * a copy of this software and associated documentation files (the
6  * "Software"), to deal in the Software without restriction, including
7  * without limitation the rights to use, copy, modify, merge, publish,
8  * distribute, sublicense, and/or sell copies of the Software, and to
9  * permit persons to whom the Software is furnished to do so, subject to
10  * the following conditions:
11  *
12  * The above copyright notice and this permission notice shall be
13  * included in all copies or substantial portions of the Software.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22  * SOFTWARE.
23  */
24 
25 #define BR_ENABLE_INTRINSICS   1
26 #include "inner.h"
27 
28 #if BR_AES_X86NI
29 
30 /* see bearssl_block.h */
31 const br_block_ctrcbc_class *
32 br_aes_x86ni_ctrcbc_get_vtable(void)
33 {
34 	return br_aes_x86ni_supported() ? &br_aes_x86ni_ctrcbc_vtable : NULL;
35 }
36 
37 /* see bearssl_block.h */
38 void
39 br_aes_x86ni_ctrcbc_init(br_aes_x86ni_ctrcbc_keys *ctx,
40 	const void *key, size_t len)
41 {
42 	ctx->vtable = &br_aes_x86ni_ctrcbc_vtable;
43 	ctx->num_rounds = br_aes_x86ni_keysched_enc(ctx->skey.skni, key, len);
44 }
45 
46 BR_TARGETS_X86_UP
47 
48 /* see bearssl_block.h */
49 BR_TARGET("sse2,sse4.1,aes")
50 void
51 br_aes_x86ni_ctrcbc_ctr(const br_aes_x86ni_ctrcbc_keys *ctx,
52 	void *ctr, void *data, size_t len)
53 {
54 	unsigned char *buf;
55 	unsigned num_rounds;
56 	__m128i sk[15];
57 	__m128i ivx0, ivx1, ivx2, ivx3;
58 	__m128i erev, zero, one, four, notthree;
59 	unsigned u;
60 
61 	buf = data;
62 	num_rounds = ctx->num_rounds;
63 	for (u = 0; u <= num_rounds; u ++) {
64 		sk[u] = _mm_loadu_si128((void *)(ctx->skey.skni + (u << 4)));
65 	}
66 
67 	/*
68 	 * Some SSE2 constants.
69 	 */
70 	erev = _mm_set_epi8(0, 1, 2, 3, 4, 5, 6, 7,
71 		8, 9, 10, 11, 12, 13, 14, 15);
72 	zero = _mm_setzero_si128();
73 	one = _mm_set_epi64x(0, 1);
74 	four = _mm_set_epi64x(0, 4);
75 	notthree = _mm_sub_epi64(zero, four);
76 
77 	/*
78 	 * Decode the counter in big-endian and pre-increment the other
79 	 * three counters.
80 	 */
81 	ivx0 = _mm_shuffle_epi8(_mm_loadu_si128((void *)ctr), erev);
82 	ivx1 = _mm_add_epi64(ivx0, one);
83 	ivx1 = _mm_sub_epi64(ivx1,
84 		_mm_slli_si128(_mm_cmpeq_epi64(ivx1, zero), 8));
85 	ivx2 = _mm_add_epi64(ivx1, one);
86 	ivx2 = _mm_sub_epi64(ivx2,
87 		_mm_slli_si128(_mm_cmpeq_epi64(ivx2, zero), 8));
88 	ivx3 = _mm_add_epi64(ivx2, one);
89 	ivx3 = _mm_sub_epi64(ivx3,
90 		_mm_slli_si128(_mm_cmpeq_epi64(ivx3, zero), 8));
91 	while (len > 0) {
92 		__m128i x0, x1, x2, x3;
93 
94 		/*
95 		 * Load counter values; we need to byteswap them because
96 		 * the specification says that they use big-endian.
97 		 */
98 		x0 = _mm_shuffle_epi8(ivx0, erev);
99 		x1 = _mm_shuffle_epi8(ivx1, erev);
100 		x2 = _mm_shuffle_epi8(ivx2, erev);
101 		x3 = _mm_shuffle_epi8(ivx3, erev);
102 
103 		x0 = _mm_xor_si128(x0, sk[0]);
104 		x1 = _mm_xor_si128(x1, sk[0]);
105 		x2 = _mm_xor_si128(x2, sk[0]);
106 		x3 = _mm_xor_si128(x3, sk[0]);
107 		x0 = _mm_aesenc_si128(x0, sk[1]);
108 		x1 = _mm_aesenc_si128(x1, sk[1]);
109 		x2 = _mm_aesenc_si128(x2, sk[1]);
110 		x3 = _mm_aesenc_si128(x3, sk[1]);
111 		x0 = _mm_aesenc_si128(x0, sk[2]);
112 		x1 = _mm_aesenc_si128(x1, sk[2]);
113 		x2 = _mm_aesenc_si128(x2, sk[2]);
114 		x3 = _mm_aesenc_si128(x3, sk[2]);
115 		x0 = _mm_aesenc_si128(x0, sk[3]);
116 		x1 = _mm_aesenc_si128(x1, sk[3]);
117 		x2 = _mm_aesenc_si128(x2, sk[3]);
118 		x3 = _mm_aesenc_si128(x3, sk[3]);
119 		x0 = _mm_aesenc_si128(x0, sk[4]);
120 		x1 = _mm_aesenc_si128(x1, sk[4]);
121 		x2 = _mm_aesenc_si128(x2, sk[4]);
122 		x3 = _mm_aesenc_si128(x3, sk[4]);
123 		x0 = _mm_aesenc_si128(x0, sk[5]);
124 		x1 = _mm_aesenc_si128(x1, sk[5]);
125 		x2 = _mm_aesenc_si128(x2, sk[5]);
126 		x3 = _mm_aesenc_si128(x3, sk[5]);
127 		x0 = _mm_aesenc_si128(x0, sk[6]);
128 		x1 = _mm_aesenc_si128(x1, sk[6]);
129 		x2 = _mm_aesenc_si128(x2, sk[6]);
130 		x3 = _mm_aesenc_si128(x3, sk[6]);
131 		x0 = _mm_aesenc_si128(x0, sk[7]);
132 		x1 = _mm_aesenc_si128(x1, sk[7]);
133 		x2 = _mm_aesenc_si128(x2, sk[7]);
134 		x3 = _mm_aesenc_si128(x3, sk[7]);
135 		x0 = _mm_aesenc_si128(x0, sk[8]);
136 		x1 = _mm_aesenc_si128(x1, sk[8]);
137 		x2 = _mm_aesenc_si128(x2, sk[8]);
138 		x3 = _mm_aesenc_si128(x3, sk[8]);
139 		x0 = _mm_aesenc_si128(x0, sk[9]);
140 		x1 = _mm_aesenc_si128(x1, sk[9]);
141 		x2 = _mm_aesenc_si128(x2, sk[9]);
142 		x3 = _mm_aesenc_si128(x3, sk[9]);
143 		if (num_rounds == 10) {
144 			x0 = _mm_aesenclast_si128(x0, sk[10]);
145 			x1 = _mm_aesenclast_si128(x1, sk[10]);
146 			x2 = _mm_aesenclast_si128(x2, sk[10]);
147 			x3 = _mm_aesenclast_si128(x3, sk[10]);
148 		} else if (num_rounds == 12) {
149 			x0 = _mm_aesenc_si128(x0, sk[10]);
150 			x1 = _mm_aesenc_si128(x1, sk[10]);
151 			x2 = _mm_aesenc_si128(x2, sk[10]);
152 			x3 = _mm_aesenc_si128(x3, sk[10]);
153 			x0 = _mm_aesenc_si128(x0, sk[11]);
154 			x1 = _mm_aesenc_si128(x1, sk[11]);
155 			x2 = _mm_aesenc_si128(x2, sk[11]);
156 			x3 = _mm_aesenc_si128(x3, sk[11]);
157 			x0 = _mm_aesenclast_si128(x0, sk[12]);
158 			x1 = _mm_aesenclast_si128(x1, sk[12]);
159 			x2 = _mm_aesenclast_si128(x2, sk[12]);
160 			x3 = _mm_aesenclast_si128(x3, sk[12]);
161 		} else {
162 			x0 = _mm_aesenc_si128(x0, sk[10]);
163 			x1 = _mm_aesenc_si128(x1, sk[10]);
164 			x2 = _mm_aesenc_si128(x2, sk[10]);
165 			x3 = _mm_aesenc_si128(x3, sk[10]);
166 			x0 = _mm_aesenc_si128(x0, sk[11]);
167 			x1 = _mm_aesenc_si128(x1, sk[11]);
168 			x2 = _mm_aesenc_si128(x2, sk[11]);
169 			x3 = _mm_aesenc_si128(x3, sk[11]);
170 			x0 = _mm_aesenc_si128(x0, sk[12]);
171 			x1 = _mm_aesenc_si128(x1, sk[12]);
172 			x2 = _mm_aesenc_si128(x2, sk[12]);
173 			x3 = _mm_aesenc_si128(x3, sk[12]);
174 			x0 = _mm_aesenc_si128(x0, sk[13]);
175 			x1 = _mm_aesenc_si128(x1, sk[13]);
176 			x2 = _mm_aesenc_si128(x2, sk[13]);
177 			x3 = _mm_aesenc_si128(x3, sk[13]);
178 			x0 = _mm_aesenclast_si128(x0, sk[14]);
179 			x1 = _mm_aesenclast_si128(x1, sk[14]);
180 			x2 = _mm_aesenclast_si128(x2, sk[14]);
181 			x3 = _mm_aesenclast_si128(x3, sk[14]);
182 		}
183 		if (len >= 64) {
184 			x0 = _mm_xor_si128(x0,
185 				_mm_loadu_si128((void *)(buf +  0)));
186 			x1 = _mm_xor_si128(x1,
187 				_mm_loadu_si128((void *)(buf + 16)));
188 			x2 = _mm_xor_si128(x2,
189 				_mm_loadu_si128((void *)(buf + 32)));
190 			x3 = _mm_xor_si128(x3,
191 				_mm_loadu_si128((void *)(buf + 48)));
192 			_mm_storeu_si128((void *)(buf +  0), x0);
193 			_mm_storeu_si128((void *)(buf + 16), x1);
194 			_mm_storeu_si128((void *)(buf + 32), x2);
195 			_mm_storeu_si128((void *)(buf + 48), x3);
196 			buf += 64;
197 			len -= 64;
198 		} else {
199 			unsigned char tmp[64];
200 
201 			_mm_storeu_si128((void *)(tmp +  0), x0);
202 			_mm_storeu_si128((void *)(tmp + 16), x1);
203 			_mm_storeu_si128((void *)(tmp + 32), x2);
204 			_mm_storeu_si128((void *)(tmp + 48), x3);
205 			for (u = 0; u < len; u ++) {
206 				buf[u] ^= tmp[u];
207 			}
208 			switch (len) {
209 			case 16:
210 				ivx0 = ivx1;
211 				break;
212 			case 32:
213 				ivx0 = ivx2;
214 				break;
215 			case 48:
216 				ivx0 = ivx3;
217 				break;
218 			}
219 			break;
220 		}
221 
222 		/*
223 		 * Add 4 to each counter value. For carry propagation
224 		 * into the upper 64-bit words, we would need to compare
225 		 * the results with 4, but SSE2+ has only _signed_
226 		 * comparisons. Instead, we mask out the low two bits,
227 		 * and check whether the remaining bits are zero.
228 		 */
229 		ivx0 = _mm_add_epi64(ivx0, four);
230 		ivx1 = _mm_add_epi64(ivx1, four);
231 		ivx2 = _mm_add_epi64(ivx2, four);
232 		ivx3 = _mm_add_epi64(ivx3, four);
233 		ivx0 = _mm_sub_epi64(ivx0,
234 			_mm_slli_si128(_mm_cmpeq_epi64(
235 				_mm_and_si128(ivx0, notthree), zero), 8));
236 		ivx1 = _mm_sub_epi64(ivx1,
237 			_mm_slli_si128(_mm_cmpeq_epi64(
238 				_mm_and_si128(ivx1, notthree), zero), 8));
239 		ivx2 = _mm_sub_epi64(ivx2,
240 			_mm_slli_si128(_mm_cmpeq_epi64(
241 				_mm_and_si128(ivx2, notthree), zero), 8));
242 		ivx3 = _mm_sub_epi64(ivx3,
243 			_mm_slli_si128(_mm_cmpeq_epi64(
244 				_mm_and_si128(ivx3, notthree), zero), 8));
245 	}
246 
247 	/*
248 	 * Write back new counter value. The loop took care to put the
249 	 * right counter value in ivx0.
250 	 */
251 	_mm_storeu_si128((void *)ctr, _mm_shuffle_epi8(ivx0, erev));
252 }
253 
254 /* see bearssl_block.h */
255 BR_TARGET("sse2,sse4.1,aes")
256 void
257 br_aes_x86ni_ctrcbc_mac(const br_aes_x86ni_ctrcbc_keys *ctx,
258 	void *cbcmac, const void *data, size_t len)
259 {
260 	const unsigned char *buf;
261 	unsigned num_rounds;
262 	__m128i sk[15], ivx;
263 	unsigned u;
264 
265 	buf = data;
266 	ivx = _mm_loadu_si128(cbcmac);
267 	num_rounds = ctx->num_rounds;
268 	for (u = 0; u <= num_rounds; u ++) {
269 		sk[u] = _mm_loadu_si128((void *)(ctx->skey.skni + (u << 4)));
270 	}
271 	while (len > 0) {
272 		__m128i x;
273 
274 		x = _mm_xor_si128(_mm_loadu_si128((void *)buf), ivx);
275 		x = _mm_xor_si128(x, sk[0]);
276 		x = _mm_aesenc_si128(x, sk[1]);
277 		x = _mm_aesenc_si128(x, sk[2]);
278 		x = _mm_aesenc_si128(x, sk[3]);
279 		x = _mm_aesenc_si128(x, sk[4]);
280 		x = _mm_aesenc_si128(x, sk[5]);
281 		x = _mm_aesenc_si128(x, sk[6]);
282 		x = _mm_aesenc_si128(x, sk[7]);
283 		x = _mm_aesenc_si128(x, sk[8]);
284 		x = _mm_aesenc_si128(x, sk[9]);
285 		if (num_rounds == 10) {
286 			x = _mm_aesenclast_si128(x, sk[10]);
287 		} else if (num_rounds == 12) {
288 			x = _mm_aesenc_si128(x, sk[10]);
289 			x = _mm_aesenc_si128(x, sk[11]);
290 			x = _mm_aesenclast_si128(x, sk[12]);
291 		} else {
292 			x = _mm_aesenc_si128(x, sk[10]);
293 			x = _mm_aesenc_si128(x, sk[11]);
294 			x = _mm_aesenc_si128(x, sk[12]);
295 			x = _mm_aesenc_si128(x, sk[13]);
296 			x = _mm_aesenclast_si128(x, sk[14]);
297 		}
298 		ivx = x;
299 		buf += 16;
300 		len -= 16;
301 	}
302 	_mm_storeu_si128(cbcmac, ivx);
303 }
304 
305 /* see bearssl_block.h */
306 BR_TARGET("sse2,sse4.1,aes")
307 void
308 br_aes_x86ni_ctrcbc_encrypt(const br_aes_x86ni_ctrcbc_keys *ctx,
309 	void *ctr, void *cbcmac, void *data, size_t len)
310 {
311 	unsigned char *buf;
312 	unsigned num_rounds;
313 	__m128i sk[15];
314 	__m128i ivx, cmx;
315 	__m128i erev, zero, one;
316 	unsigned u;
317 	int first_iter;
318 
319 	num_rounds = ctx->num_rounds;
320 	for (u = 0; u <= num_rounds; u ++) {
321 		sk[u] = _mm_loadu_si128((void *)(ctx->skey.skni + (u << 4)));
322 	}
323 
324 	/*
325 	 * Some SSE2 constants.
326 	 */
327 	erev = _mm_set_epi8(0, 1, 2, 3, 4, 5, 6, 7,
328 		8, 9, 10, 11, 12, 13, 14, 15);
329 	zero = _mm_setzero_si128();
330 	one = _mm_set_epi64x(0, 1);
331 
332 	/*
333 	 * Decode the counter in big-endian.
334 	 */
335 	ivx = _mm_shuffle_epi8(_mm_loadu_si128(ctr), erev);
336 	cmx = _mm_loadu_si128(cbcmac);
337 
338 	buf = data;
339 	first_iter = 1;
340 	while (len > 0) {
341 		__m128i dx, x0, x1;
342 
343 		/*
344 		 * Load initial values:
345 		 *   dx   encrypted block of data
346 		 *   x0   counter (for CTR encryption)
347 		 *   x1   input for CBC-MAC
348 		 */
349 		dx = _mm_loadu_si128((void *)buf);
350 		x0 = _mm_shuffle_epi8(ivx, erev);
351 		x1 = cmx;
352 
353 		x0 = _mm_xor_si128(x0, sk[0]);
354 		x1 = _mm_xor_si128(x1, sk[0]);
355 		x0 = _mm_aesenc_si128(x0, sk[1]);
356 		x1 = _mm_aesenc_si128(x1, sk[1]);
357 		x0 = _mm_aesenc_si128(x0, sk[2]);
358 		x1 = _mm_aesenc_si128(x1, sk[2]);
359 		x0 = _mm_aesenc_si128(x0, sk[3]);
360 		x1 = _mm_aesenc_si128(x1, sk[3]);
361 		x0 = _mm_aesenc_si128(x0, sk[4]);
362 		x1 = _mm_aesenc_si128(x1, sk[4]);
363 		x0 = _mm_aesenc_si128(x0, sk[5]);
364 		x1 = _mm_aesenc_si128(x1, sk[5]);
365 		x0 = _mm_aesenc_si128(x0, sk[6]);
366 		x1 = _mm_aesenc_si128(x1, sk[6]);
367 		x0 = _mm_aesenc_si128(x0, sk[7]);
368 		x1 = _mm_aesenc_si128(x1, sk[7]);
369 		x0 = _mm_aesenc_si128(x0, sk[8]);
370 		x1 = _mm_aesenc_si128(x1, sk[8]);
371 		x0 = _mm_aesenc_si128(x0, sk[9]);
372 		x1 = _mm_aesenc_si128(x1, sk[9]);
373 		if (num_rounds == 10) {
374 			x0 = _mm_aesenclast_si128(x0, sk[10]);
375 			x1 = _mm_aesenclast_si128(x1, sk[10]);
376 		} else if (num_rounds == 12) {
377 			x0 = _mm_aesenc_si128(x0, sk[10]);
378 			x1 = _mm_aesenc_si128(x1, sk[10]);
379 			x0 = _mm_aesenc_si128(x0, sk[11]);
380 			x1 = _mm_aesenc_si128(x1, sk[11]);
381 			x0 = _mm_aesenclast_si128(x0, sk[12]);
382 			x1 = _mm_aesenclast_si128(x1, sk[12]);
383 		} else {
384 			x0 = _mm_aesenc_si128(x0, sk[10]);
385 			x1 = _mm_aesenc_si128(x1, sk[10]);
386 			x0 = _mm_aesenc_si128(x0, sk[11]);
387 			x1 = _mm_aesenc_si128(x1, sk[11]);
388 			x0 = _mm_aesenc_si128(x0, sk[12]);
389 			x1 = _mm_aesenc_si128(x1, sk[12]);
390 			x0 = _mm_aesenc_si128(x0, sk[13]);
391 			x1 = _mm_aesenc_si128(x1, sk[13]);
392 			x0 = _mm_aesenclast_si128(x0, sk[14]);
393 			x1 = _mm_aesenclast_si128(x1, sk[14]);
394 		}
395 
396 		x0 = _mm_xor_si128(x0, dx);
397 		if (first_iter) {
398 			cmx = _mm_xor_si128(cmx, x0);
399 			first_iter = 0;
400 		} else {
401 			cmx = _mm_xor_si128(x1, x0);
402 		}
403 		_mm_storeu_si128((void *)buf, x0);
404 
405 		buf += 16;
406 		len -= 16;
407 
408 		/*
409 		 * Increment the counter value.
410 		 */
411 		ivx = _mm_add_epi64(ivx, one);
412 		ivx = _mm_sub_epi64(ivx,
413 			_mm_slli_si128(_mm_cmpeq_epi64(ivx, zero), 8));
414 
415 		/*
416 		 * If this was the last iteration, then compute the
417 		 * extra block encryption to complete CBC-MAC.
418 		 */
419 		if (len == 0) {
420 			cmx = _mm_xor_si128(cmx, sk[0]);
421 			cmx = _mm_aesenc_si128(cmx, sk[1]);
422 			cmx = _mm_aesenc_si128(cmx, sk[2]);
423 			cmx = _mm_aesenc_si128(cmx, sk[3]);
424 			cmx = _mm_aesenc_si128(cmx, sk[4]);
425 			cmx = _mm_aesenc_si128(cmx, sk[5]);
426 			cmx = _mm_aesenc_si128(cmx, sk[6]);
427 			cmx = _mm_aesenc_si128(cmx, sk[7]);
428 			cmx = _mm_aesenc_si128(cmx, sk[8]);
429 			cmx = _mm_aesenc_si128(cmx, sk[9]);
430 			if (num_rounds == 10) {
431 				cmx = _mm_aesenclast_si128(cmx, sk[10]);
432 			} else if (num_rounds == 12) {
433 				cmx = _mm_aesenc_si128(cmx, sk[10]);
434 				cmx = _mm_aesenc_si128(cmx, sk[11]);
435 				cmx = _mm_aesenclast_si128(cmx, sk[12]);
436 			} else {
437 				cmx = _mm_aesenc_si128(cmx, sk[10]);
438 				cmx = _mm_aesenc_si128(cmx, sk[11]);
439 				cmx = _mm_aesenc_si128(cmx, sk[12]);
440 				cmx = _mm_aesenc_si128(cmx, sk[13]);
441 				cmx = _mm_aesenclast_si128(cmx, sk[14]);
442 			}
443 			break;
444 		}
445 	}
446 
447 	/*
448 	 * Write back new counter value and CBC-MAC value.
449 	 */
450 	_mm_storeu_si128(ctr, _mm_shuffle_epi8(ivx, erev));
451 	_mm_storeu_si128(cbcmac, cmx);
452 }
453 
454 /* see bearssl_block.h */
455 BR_TARGET("sse2,sse4.1,aes")
456 void
457 br_aes_x86ni_ctrcbc_decrypt(const br_aes_x86ni_ctrcbc_keys *ctx,
458 	void *ctr, void *cbcmac, void *data, size_t len)
459 {
460 	unsigned char *buf;
461 	unsigned num_rounds;
462 	__m128i sk[15];
463 	__m128i ivx, cmx;
464 	__m128i erev, zero, one;
465 	unsigned u;
466 
467 	num_rounds = ctx->num_rounds;
468 	for (u = 0; u <= num_rounds; u ++) {
469 		sk[u] = _mm_loadu_si128((void *)(ctx->skey.skni + (u << 4)));
470 	}
471 
472 	/*
473 	 * Some SSE2 constants.
474 	 */
475 	erev = _mm_set_epi8(0, 1, 2, 3, 4, 5, 6, 7,
476 		8, 9, 10, 11, 12, 13, 14, 15);
477 	zero = _mm_setzero_si128();
478 	one = _mm_set_epi64x(0, 1);
479 
480 	/*
481 	 * Decode the counter in big-endian.
482 	 */
483 	ivx = _mm_shuffle_epi8(_mm_loadu_si128(ctr), erev);
484 	cmx = _mm_loadu_si128(cbcmac);
485 
486 	buf = data;
487 	while (len > 0) {
488 		__m128i dx, x0, x1;
489 
490 		/*
491 		 * Load initial values:
492 		 *   dx   encrypted block of data
493 		 *   x0   counter (for CTR encryption)
494 		 *   x1   input for CBC-MAC
495 		 */
496 		dx = _mm_loadu_si128((void *)buf);
497 		x0 = _mm_shuffle_epi8(ivx, erev);
498 		x1 = _mm_xor_si128(cmx, dx);
499 
500 		x0 = _mm_xor_si128(x0, sk[0]);
501 		x1 = _mm_xor_si128(x1, sk[0]);
502 		x0 = _mm_aesenc_si128(x0, sk[1]);
503 		x1 = _mm_aesenc_si128(x1, sk[1]);
504 		x0 = _mm_aesenc_si128(x0, sk[2]);
505 		x1 = _mm_aesenc_si128(x1, sk[2]);
506 		x0 = _mm_aesenc_si128(x0, sk[3]);
507 		x1 = _mm_aesenc_si128(x1, sk[3]);
508 		x0 = _mm_aesenc_si128(x0, sk[4]);
509 		x1 = _mm_aesenc_si128(x1, sk[4]);
510 		x0 = _mm_aesenc_si128(x0, sk[5]);
511 		x1 = _mm_aesenc_si128(x1, sk[5]);
512 		x0 = _mm_aesenc_si128(x0, sk[6]);
513 		x1 = _mm_aesenc_si128(x1, sk[6]);
514 		x0 = _mm_aesenc_si128(x0, sk[7]);
515 		x1 = _mm_aesenc_si128(x1, sk[7]);
516 		x0 = _mm_aesenc_si128(x0, sk[8]);
517 		x1 = _mm_aesenc_si128(x1, sk[8]);
518 		x0 = _mm_aesenc_si128(x0, sk[9]);
519 		x1 = _mm_aesenc_si128(x1, sk[9]);
520 		if (num_rounds == 10) {
521 			x0 = _mm_aesenclast_si128(x0, sk[10]);
522 			x1 = _mm_aesenclast_si128(x1, sk[10]);
523 		} else if (num_rounds == 12) {
524 			x0 = _mm_aesenc_si128(x0, sk[10]);
525 			x1 = _mm_aesenc_si128(x1, sk[10]);
526 			x0 = _mm_aesenc_si128(x0, sk[11]);
527 			x1 = _mm_aesenc_si128(x1, sk[11]);
528 			x0 = _mm_aesenclast_si128(x0, sk[12]);
529 			x1 = _mm_aesenclast_si128(x1, sk[12]);
530 		} else {
531 			x0 = _mm_aesenc_si128(x0, sk[10]);
532 			x1 = _mm_aesenc_si128(x1, sk[10]);
533 			x0 = _mm_aesenc_si128(x0, sk[11]);
534 			x1 = _mm_aesenc_si128(x1, sk[11]);
535 			x0 = _mm_aesenc_si128(x0, sk[12]);
536 			x1 = _mm_aesenc_si128(x1, sk[12]);
537 			x0 = _mm_aesenc_si128(x0, sk[13]);
538 			x1 = _mm_aesenc_si128(x1, sk[13]);
539 			x0 = _mm_aesenclast_si128(x0, sk[14]);
540 			x1 = _mm_aesenclast_si128(x1, sk[14]);
541 		}
542 		x0 = _mm_xor_si128(x0, dx);
543 		cmx = x1;
544 		_mm_storeu_si128((void *)buf, x0);
545 
546 		buf += 16;
547 		len -= 16;
548 
549 		/*
550 		 * Increment the counter value.
551 		 */
552 		ivx = _mm_add_epi64(ivx, one);
553 		ivx = _mm_sub_epi64(ivx,
554 			_mm_slli_si128(_mm_cmpeq_epi64(ivx, zero), 8));
555 	}
556 
557 	/*
558 	 * Write back new counter value and CBC-MAC value.
559 	 */
560 	_mm_storeu_si128(ctr, _mm_shuffle_epi8(ivx, erev));
561 	_mm_storeu_si128(cbcmac, cmx);
562 }
563 
564 BR_TARGETS_X86_DOWN
565 
566 /* see bearssl_block.h */
567 const br_block_ctrcbc_class br_aes_x86ni_ctrcbc_vtable = {
568 	sizeof(br_aes_x86ni_ctrcbc_keys),
569 	16,
570 	4,
571 	(void (*)(const br_block_ctrcbc_class **, const void *, size_t))
572 		&br_aes_x86ni_ctrcbc_init,
573 	(void (*)(const br_block_ctrcbc_class *const *,
574 		void *, void *, void *, size_t))
575 		&br_aes_x86ni_ctrcbc_encrypt,
576 	(void (*)(const br_block_ctrcbc_class *const *,
577 		void *, void *, void *, size_t))
578 		&br_aes_x86ni_ctrcbc_decrypt,
579 	(void (*)(const br_block_ctrcbc_class *const *,
580 		void *, void *, size_t))
581 		&br_aes_x86ni_ctrcbc_ctr,
582 	(void (*)(const br_block_ctrcbc_class *const *,
583 		void *, const void *, size_t))
584 		&br_aes_x86ni_ctrcbc_mac
585 };
586 
587 #else
588 
589 /* see bearssl_block.h */
590 const br_block_ctrcbc_class *
591 br_aes_x86ni_ctrcbc_get_vtable(void)
592 {
593 	return NULL;
594 }
595 
596 #endif
597